@agent-beam/beam 0.2.28 → 0.2.30

package/dist/monitor-pipeline.js

@@ -1,4 +1,4 @@
-import { clientIp, isAuthFailure, lineSource, matchLine, redactLine } from "./monitor-rules.js";
+import { clientIp, isAuthFailure, isLlmRequest, lineSource, matchLine, redactLine } from "./monitor-rules.js";
 /** A short, stable fingerprint (two seeded 53-bit hashes); not cryptographic, only used for dedupe ids. */
 export function fingerprint(text) {
     const h = (seed) => {
@@ -23,6 +23,10 @@ export const DEDUPE_WINDOW_MS = { light: 60 * 60_000, standard: 15 * 60_000, str
 // Failed sign-ins from one address within five minutes before it counts as brute forcing.
 export const BRUTE_FORCE_THRESHOLD = { light: 50, standard: 20, strict: 10 };
 const BRUTE_FORCE_WINDOW_MS = 5 * 60_000;
+// Paid model calls from one sender within five minutes before it counts as abuse: scripted use
+// that runs up the app's LLM bill ("denial of wallet") or scrapes the model through the app.
+export const LLM_FLOOD_THRESHOLD = { light: 1500, standard: 300, strict: 120 };
+const LLM_FLOOD_WINDOW_MS = 5 * 60_000;
 // A scan or a log loop can match thousands of distinct lines; past this many new findings in ten
 // minutes the rest are folded into one summary finding so a flood can't spend the month's allowance.
 export const MAX_NEW_FINDINGS_PER_10_MIN = 200;
@@ -39,55 +43,177 @@ function normalizeForGrouping(line) {
         .replace(/\s+/g, " ")
         .slice(0, 300);
 }
+const clock = () => (globalThis.performance?.now?.() ?? Date.now());
+/**
+ * A hard cap on detection time per minute, so monitoring can never take more than a fixed share of
+ * a CPU, whatever the traffic or input. Work over the cap is skipped and counted, not queued.
+ */
+export class CpuBudget {
+    msPerMinute;
+    minute = -1;
+    spent = 0;
+    skippedSince = 0;
+    constructor(msPerMinute) {
+        this.msPerMinute = msPerMinute;
+    }
+    /** Runs `work` if this minute's budget isn't spent; otherwise skips it and returns undefined. */
+    run(work) {
+        const minute = Math.floor(Date.now() / 60_000);
+        if (minute !== this.minute) {
+            this.minute = minute;
+            this.spent = 0;
+        }
+        if (this.spent >= this.msPerMinute) {
+            this.skippedSince++;
+            return undefined;
+        }
+        const start = clock();
+        try {
+            return work();
+        }
+        finally {
+            this.spent += clock() - start;
+        }
+    }
+    /** How many were skipped since the last call (for a diagnostic). */
+    takeSkipped() { const n = this.skippedSince; this.skippedSince = 0; return n; }
+}
+/**
+ * Events per key over the last few minutes, in one-minute buckets: a fixed few numbers per key
+ * however busy the key is, and at most `maxKeys` keys (the least recently active go first).
+ */
+export class WindowCounter {
+    windowMinutes;
+    maxKeys;
+    keys = new Map();
+    constructor(windowMinutes, maxKeys = 10_000) {
+        this.windowMinutes = windowMinutes;
+        this.maxKeys = maxKeys;
+    }
+    get size() { return this.keys.size; }
+    /** Records one event and returns the count over the window, this one included. */
+    add(key, now) {
+        const minute = Math.floor(now / 60_000);
+        let entry = this.keys.get(key);
+        if (entry)
+            this.keys.delete(key); // re-inserted below: Map order is then least recently active first
+        else
+            entry = { minutes: new Array(this.windowMinutes).fill(-1), counts: new Array(this.windowMinutes).fill(0) };
+        const slot = minute % this.windowMinutes;
+        if (entry.minutes[slot] !== minute) {
+            entry.minutes[slot] = minute;
+            entry.counts[slot] = 0;
+        }
+        entry.counts[slot]++;
+        this.keys.set(key, entry);
+        if (this.keys.size > this.maxKeys)
+            this.keys.delete(this.keys.keys().next().value);
+        let total = 0;
+        for (let i = 0; i < this.windowMinutes; i++)
+            if (minute - entry.minutes[i] < this.windowMinutes)
+                total += entry.counts[i];
+        return total;
+    }
+    /** Drops keys with nothing in the window. */
+    prune(now) {
+        const minute = Math.floor(now / 60_000);
+        for (const [key, entry] of this.keys)
+            if (Math.max(...entry.minutes) <= minute - this.windowMinutes)
+                this.keys.delete(key);
+    }
+}
 export class MonitorPipeline {
     opts;
     seen = new Map();
     queue = [];
     queued = new Set();
-    authFailures = new Map();
+    authFailures = new WindowCounter(BRUTE_FORCE_WINDOW_MS / 60_000);
+    llmCalls = new WindowCounter(LLM_FLOOD_WINDOW_MS / 60_000);
     floodBucket = -1;
     floodCount = 0;
     suppressed = null;
+    maintainedMinute = -1;
+    budget;
     constructor(opts) {
         this.opts = opts;
+        this.budget = opts.budget ?? (opts.cpuBudgetMsPerMinute ? new CpuBudget(opts.cpuBudgetMsPerMinute) : null);
     }
     now() { return this.opts.now?.() ?? Date.now(); }
     get pending() { return [...this.queue]; }
-    /** Matches one line and queues any findings at or above the level. Returns the rule ids raised. */
-    ingestLine(line, file) {
+    /** Sizes of everything the pipeline keeps, for tests and diagnostics: all of them are bounded. */
+    get footprint() {
+        return { seen: this.seen.size, queue: this.queue.length, queued: this.queued.size, authFailures: this.authFailures.size, llmCalls: this.llmCalls.size };
+    }
+    /** Once a minute: forget dedupe entries and counters that can no longer matter. */
+    maintain(now) {
+        const minute = Math.floor(now / 60_000);
+        if (minute === this.maintainedMinute)
+            return;
+        this.maintainedMinute = minute;
+        const cutoff = now - 2 * DEDUPE_WINDOW_MS.light;
+        for (const [fp, entry] of this.seen)
+            if (entry.at < cutoff)
+                this.seen.delete(fp);
+        this.authFailures.prune(now);
+        this.llmCalls.prune(now);
+        if (this.queued.size > 5000)
+            this.queued.clear(); // dependency ids; a repeat is deduped by the server too
+    }
+    /**
+     * Matches one line and queues any findings at or above the level. Returns the rule ids raised.
+     * Over the CPU budget, the line is skipped (see budget.takeSkipped()).
+     */
+    ingestLine(line, file, options = {}) {
+        if (!this.budget)
+            return this.ingest(line, file, options);
+        return this.budget.run(() => this.ingest(line, file, options)) ?? [];
+    }
+    ingest(line, file, options) {
         const level = this.opts.level();
         if (!level || !line.trim())
             return [];
         const custom = this.opts.customDetectors?.() ?? [];
-        const source = lineSource(line);
-        const ip = source === "http" ? clientIp(line) : undefined;
+        const source = options.source ?? lineSource(line);
+        // Prompts and model output travel as "log" findings, which every workspace version accepts.
+        const wire = source === "http" ? "http" : "log";
+        const ip = options.client ? redactLine(options.client, custom).slice(0, 80) : source === "http" ? clientIp(line) : undefined;
+        this.maintain(this.now());
+        const excerpt = options.excerpt === false ? "(the app withheld the text)" : redactLine(line, custom);
         const raised = [];
-        for (const rule of matchLine(line, source)) {
-            if (!meetsLevel(rule.severity, level))
+        const seenRules = new Set();
+        for (const rule of matchLine(line, source, options.rules)) {
+            if (!meetsLevel(rule.severity, level) || seenRules.has(rule.id))
                 continue;
+            seenRules.add(rule.id);
             // Traffic groups by client address (one scan = one finding); app logs group by line shape.
             this.raise(level, ip ?? normalizeForGrouping(line), {
                 ruleId: rule.id, title: ip ? `${rule.title} from ${ip}` : rule.title, severity: rule.severity,
-                category: rule.category, source, file, evidence: redactLine(line, custom),
+                category: rule.category, source: wire, file, evidence: options.excerpt === false ? `Matched "${rule.title}"; the app withheld the text.` : excerpt,
             });
             raised.push(rule.id);
         }
         if (isAuthFailure(line, source) && meetsLevel("high", level)) {
             const key = clientIp(line) ?? "unknown address";
-            const now = this.now();
-            const recent = (this.authFailures.get(key) ?? []).filter(t => now - t < BRUTE_FORCE_WINDOW_MS);
-            recent.push(now);
-            this.authFailures.set(key, recent);
-            if (this.authFailures.size > 10_000)
-                this.authFailures.delete(this.authFailures.keys().next().value);
-            if (recent.length >= BRUTE_FORCE_THRESHOLD[level]) {
+            const recent = this.authFailures.add(key, this.now());
+            if (recent >= BRUTE_FORCE_THRESHOLD[level]) {
                 this.raise(level, key, {
                     ruleId: "app.auth_bruteforce", title: `Repeated failed sign-ins from ${key}`, severity: "high", category: "recon",
-                    source, file, evidence: `${recent.length} failures in 5 minutes. Latest: ${redactLine(line, custom)}`.slice(0, 600),
+                    source: wire, file, evidence: `${recent} failures in 5 minutes. Latest: ${redactLine(line, custom)}`.slice(0, 600),
                 });
                 raised.push("app.auth_bruteforce");
             }
         }
+        // Only a known sender counts: behind a proxy that hides addresses, all traffic would look like one client.
+        if (ip && meetsLevel("high", level) && (source === "prompt" || (source === "http" && isLlmRequest(line)))) {
+            const recent = this.llmCalls.add(`${source}\0${ip}`, this.now());
+            if (recent >= LLM_FLOOD_THRESHOLD[level]) {
+                this.raise(level, ip, {
+                    ruleId: "llm.denial_of_wallet", title: `Unusual volume of LLM requests from ${ip}`, severity: "high", category: "llm",
+                    source: wire, file, evidence: `${recent} ${source === "prompt" ? "prompts" : "requests to LLM endpoints"} in 5 minutes. Scripted use runs up the model bill. Latest: ${excerpt}`.slice(0, 600),
+                });
+                raised.push("llm.denial_of_wallet");
+            }
+        }
         return raised;
     }
     /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
@@ -95,6 +221,7 @@ export class MonitorPipeline {
         const level = this.opts.level();
         if (!level || !meetsLevel(finding.severity, level) || this.queued.has(finding.id))
             return false;
+        this.maintain(this.now());
         this.queued.add(finding.id);
         this.enqueue(finding);
         return true;
@@ -158,10 +285,7 @@ export class MonitorPipeline {
                 break;
             }
         }
-        const cutoff = this.now() - 2 * DEDUPE_WINDOW_MS.light;
-        for (const [fp, entry] of this.seen)
-            if (entry.at < cutoff)
-                this.seen.delete(fp);
+        this.maintain(this.now());
     }
 }
 //# sourceMappingURL=monitor-pipeline.js.map

package/dist/monitor-pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"monitor-pipeline.js","sourceRoot":"","sources":["../src/monitor-pipeline.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhG,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE;QACzB,IAAI,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;YACpC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QACD,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACvF,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACvF,OAAO,CAAC,UAAU,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,IAAI,GAAoC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAC1F,MAAM,QAAQ,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACpF,4GAA4G;AAC5G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAyB,EAAE,KAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEhH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAiC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;AAChI,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAiC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC3G,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC,iGAAiG;AACjG,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,UAAU,GAAG,GAAG,CAAC;AAIvB,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,WAAW,EAAE;SACtB,OAAO,CAAC,8BAA8B,EAAE,MAAM,CAAC;SAC/C,OAAO,CAAC,mEAAmE,EAAE,MAAM,CAAC;SACpF,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AASD,MAAM,OAAO,eAAe;IASG;IARrB,IAAI,GAAG,IAAI,GAAG,EAAmE,CAAC;IAClF,KAAK,GAAqB,EAAE,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3B,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,WAAW,GAAG,CAAC,CAAC,CAAC;IACjB,UAAU,GAAG,CAAC,CAAC;IACf,UAAU,GAAwD,IAAI,CAAC;IAE/E,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAE9C,GAAG,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEjE,IAAI,OAAO,KAAuB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3D,mGAAmG;IACnG,UAAU,CAAC,IAAY,EAAE,IAAa;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAAE,SAAS;YAChD,2FAA2F;YAC3F,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE;gBAClD,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBAC7F,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;aAC1E,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC;YAC/F,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,MAAM;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;YACtG,IAAI,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE;oBACrB,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,iCAAiC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;oBACjH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,mCAAmC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACpH,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,UAAU,CAAC,OAAuB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,KAAmB,EAAE,QAAgB,EAAE,OAA2D;QAC9G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,gDAAgD;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,IAAI,2BAA2B,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxI,IAAI,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,OAAO,GAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACxH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC;YACX,EAAE,EAAE,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ;YACxH,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YAC3C,QAAQ,EAAE,GAAG,KAAK,wHAAwH;YAC1I,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,OAAuB;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACnC,gGAAgG;YAChG,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,QAAQ,CAAC;oBAAE,IAAI,GAAG,CAAC,CAAC;YAC3H,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,KAAK,CAAC,IAAuD;QACjE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5G,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;gBAC7B,MAAM;YACR,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;CACF"}
+{"version":3,"file":"monitor-pipeline.js","sourceRoot":"","sources":["../src/monitor-pipeline.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAqC,MAAM,oBAAoB,CAAC;AAEjJ,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE;QACzB,IAAI,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;YACpC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QACD,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACvF,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACvF,OAAO,CAAC,UAAU,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,IAAI,GAAoC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAC1F,MAAM,QAAQ,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACpF,4GAA4G;AAC5G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAyB,EAAE,KAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEhH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAiC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;AAChI,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAiC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC3G,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC,+FAA+F;AAC/F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,mBAAmB,GAAiC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC7G,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AACvC,iGAAiG;AACjG,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,UAAU,GAAG,GAAG,CAAC;AAIvB,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,WAAW,EAAE;SACtB,OAAO,CAAC,8BAA8B,EAAE,MAAM,CAAC;SAC/C,OAAO,CAAC,mEAAmE,EAAE,MAAM,CAAC;SACpF,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAwBD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAEpE;;;GAGG;AACH,MAAM,OAAO,SAAS;IAIS;IAHrB,MAAM,GAAG,CAAC,CAAC,CAAC;IACZ,KAAK,GAAG,CAAC,CAAC;IACV,YAAY,GAAG,CAAC,CAAC;IACzB,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IACpD,iGAAiG;IACjG,GAAG,CAAI,IAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAAC,CAAC;QACrE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,GAAG,KAAK,CAAC;QAAC,CAAC;IACnE,CAAC;IACD,oEAAoE;IACpE,WAAW,KAAa,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CACxF;AAED;;;GAGG;AACH,MAAM,OAAO,aAAa;IAEK;IAAwC;IAD7D,IAAI,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC1E,YAA6B,aAAqB,EAAmB,UAAU,MAAM;QAAxD,kBAAa,GAAb,aAAa,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IACzF,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,kFAAkF;IAClF,GAAG,CAAC,GAAW,EAAE,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,mEAAmE;;YAChG,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,CAAS,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,CAAS,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChI,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAC7F,KAAK,CAAC,MAAM,CAAC,IAAI,CAAE,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QACpF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE;YAAE,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,aAAa;gBAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAC5H,OAAO,KAAK,CAAC;IACf,CAAC;IACD,6CAA6C;IAC7C,KAAK,CAAC,GAAW;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7H,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAYG;IAXrB,IAAI,GAAG,IAAI,GAAG,EAAmE,CAAC;IAClF,KAAK,GAAqB,EAAE,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3B,YAAY,GAAG,IAAI,aAAa,CAAC,qBAAqB,GAAG,MAAM,CAAC,CAAC;IACjE,QAAQ,GAAG,IAAI,aAAa,CAAC,mBAAmB,GAAG,MAAM,CAAC,CAAC;IAC3D,WAAW,GAAG,CAAC,CAAC,CAAC;IACjB,UAAU,GAAG,CAAC,CAAC;IACf,UAAU,GAAwD,IAAI,CAAC;IACvE,gBAAgB,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,CAAmB;IAElC,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7G,CAAC;IAEO,GAAG,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEjE,IAAI,OAAO,KAAuB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3D,kGAAkG;IAClG,IAAI,SAAS;QACX,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1J,CAAC;IAED,mFAAmF;IAC3E,QAAQ,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAC7C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC;QAChD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,wDAAwD;IAC5G,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,IAAa,EAAE,UAAyB,EAAE;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAEO,MAAM,CAAC,IAAY,EAAE,IAAwB,EAAE,OAAsB;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QAClD,4FAA4F;QAC5F,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAChD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7H,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrG,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC1E,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,2FAA2F;YAC3F,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE;gBAClD,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBAC7F,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAC,CAAC,OAAO;aACnJ,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE;oBACrB,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,iCAAiC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;oBACjH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,mCAAmC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACnH,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,2GAA2G;QAC3G,IAAI,EAAE,IAAI,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;oBACpB,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK;oBACrH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,+DAA+D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC/L,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,UAAU,CAAC,OAAuB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAChG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,KAAmB,EAAE,QAAgB,EAAE,OAA2D;QAC9G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,gDAAgD;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,IAAI,2BAA2B,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxI,IAAI,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,OAAO,GAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACxH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC;YACX,EAAE,EAAE,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ;YACxH,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YAC3C,QAAQ,EAAE,GAAG,KAAK,wHAAwH;YAC1I,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,OAAuB;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACnC,gGAAgG;YAChG,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,QAAQ,CAAC;oBAAE,IAAI,GAAG,CAAC,CAAC;YAC3H,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,KAAK,CAAC,IAAuD;QACjE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5G,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;gBAC7B,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/monitor-rules.d.ts

@@ -1,22 +1,28 @@
 import { type RuleCategory } from "./rule-catalog.js";
 import type { CustomDetector } from "./data-detectors.js";
 import type { MonitorSeverity } from "./monitor-client.js";
-export type LineSource = "log" | "http";
+/** log/http: lines from log files and traffic. prompt/output: text going into, or coming out of, an LLM (SDK). */
+export type LineSource = "log" | "http" | "prompt" | "output";
 export interface MonitorRule {
     id: string;
     title: string;
     severity: MonitorSeverity;
-    category: RuleCategory | "exploit";
-    /** Restricts the rule to access-log lines; omitted means every line. */
+    category: RuleCategory | "exploit" | "llm";
+    /** Where the rule applies; omitted means log and http lines (never prompts or model output). */
     sources?: LineSource[];
     /** `decoded` is URL-decoded (twice, for double encoding); `raw` is the line as written. */
     match: (decoded: string, raw: string) => boolean;
 }
+/** A matched credential, or text that only looks like one (an sk- slug, a sentence). */
+export declare function keyLike(match: string): boolean;
+/** Whether the text holds something that looks like a real credential. */
+export declare function hasSecret(text: string): boolean;
 export declare const monitorRules: MonitorRule[];
 export declare function lineSource(line: string): LineSource;
 /** URL-decodes up to twice so `%252e%252e%252f` (double-encoded `../`) is matched too. */
 export declare function decodeForMatch(line: string): string;
-export declare function matchLine(line: string, source?: LineSource): MonitorRule[];
+/** The rules a line matches. Prompts and model output aren't URL-decoded: they aren't URLs. */
+export declare function matchLine(line: string, source?: LineSource, extra?: MonitorRule[]): MonitorRule[];
 /**
  * Redaction for evidence that leaves the machine. Unlike the agent-hook redaction it keeps query
  * strings -- for an access log the query usually *is* the attack -- but removes credentials,
@@ -28,5 +34,7 @@ export declare function redactLine(line: string, custom?: CustomDetector[]): str
  * nginx/Apache/Caddy common log format, otherwise the first standalone IPv4 address.
  */
 export declare function clientIp(line: string): string | undefined;
+/** A POST to what looks like an LLM endpoint (chat, completions, generate…), each one a paid model call. */
+export declare function isLlmRequest(line: string): boolean;
 /** A failed sign-in: a 401/403 on an auth path in an access log, or an app's own "login failed" line. */
 export declare function isAuthFailure(line: string, source: LineSource): boolean;

package/dist/monitor-rules.js

@@ -2,11 +2,74 @@
 // HTTP access logs. Separate from the agent-hook catalog in core.ts on purpose -- application logs
 // are full of words like "env", "token" and "production" that would drown those rules -- but a few
 // built-in rules that mean the same thing anywhere (reverse shells, piped remote code, cloud
-// metadata access, prompt injection) are reused as-is. Heuristic, like everything else in Beam.
+// metadata access) are reused as-is. Attacks on LLM features (prompt injection and friends) come
+// from prompt-attacks.ts. Heuristic, like everything else in Beam.
 import { builtinRulesById } from "./rule-catalog.js";
+import { promptAttack, revealHidden } from "./prompt-attacks.js";
 // Trailing boundary for shell commands, so `| id=5` in a log line isn't read as running `id`.
 const END = String.raw `(?=$|[\s;'"&|)\x60])`;
 const commandInjection = new RegExp(String.raw `(?:[;|\x60]|\$\(|&&)\s*(?:id|whoami|uname\s+-a|cat\s+/etc/(?:passwd|shadow)|(?:curl|wget)\s+\S+|nc\s+-\w|bash\s+-[ic]|sh\s+-c|ping\s+-c\s*\d+)${END}`, "i");
+// A URL-like parameter pointing the server at itself, its network or its cloud metadata, or a
+// scheme only an attacker wants fetched. LLM agents with browsing or fetch tools are a common way
+// in. Parameters are split and checked one by one: as one regex this backtracked quadratically on
+// long hostile query strings, and it runs inside customer apps.
+const SSRF_NAME = /url|uri|link|src|dest|target|redirect|callback|webhook|feed|host|endpoint|proxy|image|fetch|next|return/i;
+const SSRF_SCHEME = /^(?:gopher|dict|ldap|tftp|jar|netdoc):\/\//i;
+const SSRF_INTERNAL = /^(?:(?:https?|ftp):\/\/(?:localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|0x7f\w*|2130706433|\[::(?:1|ffff:[^\]]{0,40})?\]|10\.\d+\.\d+\.\d+|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|100\.100\.100\.200|metadata\.google\.internal)|file:\/)/i;
+function ssrf(s) {
+    const query = s.indexOf("?");
+    if (query < 0)
+        return false;
+    let seen = 0;
+    for (const param of s.slice(query + 1).split(/[&?\s"]/)) {
+        const eq = param.indexOf("=");
+        if (eq < 0)
+            continue;
+        if (++seen > 100)
+            break;
+        const name = param.slice(0, eq);
+        const value = param.slice(eq + 1);
+        if (SSRF_SCHEME.test(value) || (name.length <= 64 && SSRF_NAME.test(name) && SSRF_INTERNAL.test(value)))
+            return true;
+    }
+    return false;
+}
+// Credentials, by format. Case-sensitive, as the real prefixes are. The bare "sk-" family also has
+// to look random, because "sk-" turns up in ordinary text: a URL slug like
+// /blog/samsung-sk-hynix-upgrade-china-nand-plants-2026 is not an OpenAI key.
+const KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk-(?:proj-|ant-|or-v1-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9_]{30,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|gsk_[A-Za-z0-9]{40,}|hf_[A-Za-z0-9]{30,}|r8_[A-Za-z0-9]{30,}|xai-[A-Za-z0-9]{40,}|pplx-[A-Za-z0-9]{40,}|beam_app_[\w-]{20,})\b/g;
+const BEARER = /\bauthorization:\s*bearer\s+[A-Za-z0-9._~+/-]{20,}/i;
+/** A matched credential, or text that only looks like one (an sk- slug, a sentence). */
+export function keyLike(match) {
+    if (!match.startsWith("sk-"))
+        return true;
+    const body = match.replace(/^sk-(?:proj-|ant-|or-v1-|svcacct-|admin-)?/, "");
+    // Lowercase words joined by hyphens or underscores: a slug or a name, never a key.
+    if (/^[a-z0-9]+(?:[-_][a-z0-9]+){2,}$/.test(body) && /[a-z]{3,}[-_][a-z]{3,}/.test(body))
+        return false;
+    const digits = body.replace(/\D/g, "").length;
+    const mixedCase = /[a-z]/.test(body) && /[A-Z]/.test(body);
+    // Real keys: mixed case with digits (OpenAI, Anthropic), or long hex (DeepSeek, OpenRouter).
+    return (mixedCase && digits >= 2) || /^[a-f0-9]{32,}$/.test(body);
+}
+/** Whether the text holds something that looks like a real credential. */
+export function hasSecret(text) {
+    if (BEARER.test(text))
+        return true;
+    for (const [match] of text.matchAll(KEY))
+        if (keyLike(match))
+            return true;
+    return false;
+}
+const XSS = /<script[\s>]|javascript:\s*[a-z(]|<(?:img|svg|body|iframe)\b[^>]{0,200}\son(?:error|load)\s*=|\bdocument\.cookie\b/i;
+const EVERYWHERE = ["log", "http", "prompt", "output"];
+const SENSITIVE_FILE = /\/(?:\.env(?:\.[\w-]+)?|\.git\/(?:config|HEAD)|\.aws\/credentials|\.ssh\/id_\w+|wp-config\.php(?:\.bak)?|\.htpasswd|server-status|actuator\/(?:env|heapdump)|\.DS_Store)(?=[\s?"'#]|$)/i;
+const ACCESS_STATUS = /"[A-Z]+ \S+ HTTP\/[\d.]+" (\d{3})\b|"(?:status|httpStatus|status_code|statusCode|response_status)"\s*:\s*"?(\d{3})\b/;
+/** The response status in an access-log line was 2xx. */
+function isSuccess(line) {
+    const m = line.match(ACCESS_STATUS);
+    return (m?.[1] ?? m?.[2] ?? "").startsWith("2");
+}
 const appRules = [
     { id: "web.jndi_injection", title: "JNDI lookup (Log4Shell-style) injection", severity: "critical", category: "exploit",
         match: s => /\$\{\s*jndi\s*:|\$\{\s*\$\{\s*(?:::-|lower:|upper:|env:)/i.test(s) },
@@ -22,20 +85,61 @@ const appRules = [
         match: s => /\/(?:c99|r57|wso|b374k|webshell|cmd|shell)\.(?:php|jsp|aspx?)\b|[?&](?:cmd|exec|command)=(?:whoami|id|ls|uname|cat)\b/i.test(s) },
     { id: "web.deserialization", title: "Serialized object payload", severity: "high", category: "exploit",
         match: s => /\brO0AB[A-Za-z0-9+/=]{8,}|\bO:\d+:"[A-Za-z_\\]+":\d+:\{/.test(s) },
+    { id: "web.ssrf", title: "Server-side request forgery attempt", severity: "high", category: "exploit", sources: ["http"],
+        match: s => ssrf(s) },
     { id: "app.secret_in_log", title: "Credential written to logs", severity: "high", category: "secrets",
-        match: (_s, raw) => /-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9_]{30,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|beam_app_[\w-]{20,})\b|\bauthorization:\s*bearer\s+[A-Za-z0-9._~+/-]{20,}/i.test(raw) },
+        match: (_s, raw) => hasSecret(raw) },
     { id: "web.xss", title: "Cross-site scripting attempt", severity: "medium", category: "exploit",
-        match: s => /<script[\s>]|javascript:\s*[a-z(]|<(?:img|svg|body|iframe)\b[^>]{0,200}\son(?:error|load)\s*=|\bdocument\.cookie\b/i.test(s) },
+        match: s => XSS.test(s) },
     { id: "web.prototype_pollution", title: "Prototype pollution attempt", severity: "medium", category: "exploit",
         match: s => /\b__proto__\b\s*[\]["'=:.]|constructor\s*\[\s*["']?prototype/i.test(s) },
+    // Bots ask every site for /.env all day, so a probe alone is medium. One that got a 2xx back
+    // may have handed over the app's keys: high. (An app that answers 200 to every path, like a
+    // single-page app's catch-all, can trip the second.)
     { id: "web.sensitive_file_probe", title: "Probe for secrets or config files", severity: "medium", category: "recon", sources: ["http"],
-        match: s => /\/(?:\.env(?:\.[\w-]+)?|\.git\/(?:config|HEAD)|\.aws\/credentials|\.ssh\/id_\w+|wp-config\.php(?:\.bak)?|\.htpasswd|server-status|actuator\/(?:env|heapdump)|\.DS_Store)(?=[\s?"'#]|$)/i.test(s) },
+        match: s => SENSITIVE_FILE.test(s) },
+    { id: "web.secret_file_exposed", title: "Secret or config file served to a client", severity: "high", category: "secrets", sources: ["http"],
+        match: (s, raw) => SENSITIVE_FILE.test(s) && isSuccess(raw) },
     { id: "web.scanner", title: "Known attack tool", severity: "medium", category: "recon", sources: ["http"],
         match: s => /\b(?:sqlmap|nikto|nuclei|masscan|zgrab|acunetix|nessus|wpscan|dirbuster|gobuster|feroxbuster|ffuf|hydra|openvas|commix|xsstrike)\b/i.test(s) },
 ];
-const sharedRules = builtinRulesById(["network.reverse-shell", "execution.remote", "execution.obfuscated", "network.metadata", "instructions.override"])
-    .map(r => ({ id: r.id, title: r.title, severity: r.severity === "info" ? "medium" : r.severity, category: r.category, match: (s) => r.match(s) }));
-export const monitorRules = [...appRules, ...sharedRules];
+// Attacks on the app's LLM features. Prompt-side rules also read traffic and logs, because
+// prompts arrive in query strings and apps log them; forged chat markers only count where a
+// client wrote them (a model server's own logs are full of its template).
+const llmRules = [
+    { id: "llm.prompt_injection", title: "Prompt injection attempt", severity: "high", category: "llm", sources: EVERYWHERE,
+        match: s => promptAttack.override(s) },
+    { id: "llm.reviewer_manipulation", title: "Attempt to sway an AI reviewer", severity: "high", category: "llm", sources: EVERYWHERE,
+        match: s => promptAttack.reviewer(s) },
+    { id: "llm.hidden_instructions", title: "Hidden instructions in invisible Unicode", severity: "high", category: "llm", sources: EVERYWHERE,
+        match: s => promptAttack.hidden(s) },
+    { id: "llm.chat_template_injection", title: "Forged system or chat-template markers", severity: "high", category: "llm", sources: ["http", "prompt"],
+        match: s => promptAttack.chatTemplate(s) },
+    { id: "llm.secret_extraction", title: "Attempt to extract API keys or secrets", severity: "high", category: "llm", sources: ["log"],
+        match: s => promptAttack.secretRequest(s) },
+    { id: "llm.secret_extraction", title: "Attempt to extract API keys or secrets", severity: "high", category: "llm", sources: ["http", "prompt"],
+        match: s => promptAttack.secretRequest(s) || promptAttack.secretCommand(s) },
+    { id: "llm.jailbreak", title: "Jailbreak attempt", severity: "medium", category: "llm", sources: ["log", "http", "prompt"],
+        match: s => promptAttack.jailbreak(s) },
+    { id: "llm.prompt_extraction", title: "System prompt or data extraction attempt", severity: "medium", category: "llm", sources: ["log", "http", "prompt"],
+        match: s => promptAttack.extraction(s) },
+    { id: "llm.output_exfiltration", title: "Data exfiltration link in model output", severity: "high", category: "llm", sources: ["log"],
+        match: (_s, raw) => promptAttack.markdownExfil(raw) },
+    { id: "llm.output_exfiltration", title: "Data exfiltration link in model output", severity: "high", category: "llm", sources: ["output"],
+        match: (_s, raw) => promptAttack.htmlExfil(raw) },
+    { id: "llm.output_secret", title: "Credential in model output", severity: "high", category: "llm", sources: ["output"],
+        match: (_s, raw) => hasSecret(raw) || promptAttack.envSecret(raw) },
+    { id: "llm.output_script", title: "Script or active HTML in model output", severity: "medium", category: "llm", sources: ["output"],
+        match: (_s, raw) => XSS.test(raw) },
+];
+const sharedRules = builtinRulesById(["network.reverse-shell", "execution.remote", "execution.obfuscated", "network.metadata"])
+    .map(r => ({
+    id: r.id, title: r.title, severity: r.severity === "info" ? "medium" : r.severity, category: r.category, match: (s) => r.match(s),
+    // An agent asked to fetch the metadata endpoint is the same attack as a request for it.
+    ...(r.id === "network.metadata" ? { sources: EVERYWHERE } : {}),
+}));
+export const monitorRules = [...appRules, ...llmRules, ...sharedRules];
+const CLASSIC = ["log", "http"];
 const HTTP_LINE = /"(?:GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS|CONNECT|TRACE) \S+ HTTP\/[\d.]+"|^\S+ \S+ \S+ \[[^\]]+\] "|"(?:method|http_method|request_method)"\s*:\s*"[A-Z]+"/;
 export function lineSource(line) {
     return HTTP_LINE.test(line) ? "http" : "log";
@@ -59,10 +163,11 @@ export function decodeForMatch(line) {
     }
     return s;
 }
-export function matchLine(line, source = lineSource(line)) {
-    const decoded = decodeForMatch(line);
+/** The rules a line matches. Prompts and model output aren't URL-decoded: they aren't URLs. */
+export function matchLine(line, source = lineSource(line), extra = []) {
     const raw = line.length > 16_384 ? line.slice(0, 16_384) : line;
-    return monitorRules.filter(r => (!r.sources || r.sources.includes(source)) && r.match(decoded, raw));
+    const decoded = source === "prompt" || source === "output" ? raw : decodeForMatch(line);
+    return [...monitorRules, ...extra].filter(r => (r.sources ?? CLASSIC).includes(source) && r.match(decoded, raw));
 }
 /**
  * Redaction for evidence that leaves the machine. Unlike the agent-hook redaction it keeps query
@@ -70,9 +175,10 @@ export function matchLine(line, source = lineSource(line)) {
  * bearer tokens, URL userinfo, email addresses and the policy's custom detector matches.
  */
 export function redactLine(line, custom = []) {
-    let out = line.slice(0, 4000)
+    // Hidden Unicode text is made readable first, so it is redacted like the rest and a reviewer can see it.
+    let out = revealHidden(line.slice(0, 4000))
         .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED PRIVATE KEY]")
-        .replace(/\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|beam_app_[\w-]{20,})\b/g, "[REDACTED TOKEN]")
+        .replace(/\b(?:sk-(?:proj-|ant-|or-v1-|svcacct-|admin-)?[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|gsk_[A-Za-z0-9]{20,}|hf_[A-Za-z0-9]{20,}|r8_[A-Za-z0-9]{20,}|xai-[A-Za-z0-9]{20,}|pplx-[A-Za-z0-9]{20,}|beam_app_[\w-]{20,})\b/g, m => (keyLike(m) ? "[REDACTED TOKEN]" : m))
         .replace(/(bearer\s+)[A-Za-z0-9._~+/-]{8,}/gi, "$1[REDACTED]")
         .replace(/(\b(?:[\w-]*(?:api[_-]?key|token|secret|password|passwd|pwd|authorization|session|cookie)[\w-]*)["']?\s*[:=]\s*)["']?[^\s,"';&}\]]+/gi, "$1[REDACTED]")
         .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gi, "$1[REDACTED]@")
@@ -99,8 +205,21 @@ export function clientIp(line) {
 }
 const AUTH_PATH = /\/(?:login|signin|sign-in|auth|oauth|token|session|api\/v\d+\/auth|wp-login\.php|admin)\b/i;
 const AUTH_FAIL_TEXT = /\b(?:login|authentication|auth|sign[- ]?in)\s+(?:failed|failure|denied)|\binvalid\s+(?:password|credentials|username or password|api key|token)|\bfailed\s+password\b|\bincorrect\s+password\b|\bunauthori[sz]ed\b/i;
+const REQUEST_LINE = /"([A-Z]+) (\S+) HTTP\/[\d.]+"/;
+const JSON_METHOD = /"(?:method|http_method|request_method)"\s*:\s*"([A-Z]+)"/;
+const JSON_PATH = /"(?:path|uri|url|request_uri|requestPath)"\s*:\s*"([^"]+)"/;
+const LLM_PATH = /\/(?:chat|completions?|generate|llm|ai|assistant|agents?|ask|prompt|inference|copilot)(?:[/?#]|$)|\/v1\/(?:messages|responses|embeddings)(?:[/?#]|$)/i;
+/** A POST to what looks like an LLM endpoint (chat, completions, generate…), each one a paid model call. */
+export function isLlmRequest(line) {
+    const request = line.match(REQUEST_LINE);
+    const method = request?.[1] ?? line.match(JSON_METHOD)?.[1];
+    const path = request?.[2] ?? line.match(JSON_PATH)?.[1];
+    return method === "POST" && Boolean(path && LLM_PATH.test(path.split("?")[0]));
+}
 /** A failed sign-in: a 401/403 on an auth path in an access log, or an app's own "login failed" line. */
 export function isAuthFailure(line, source) {
+    if (source === "prompt" || source === "output")
+        return false; // a chat message saying "login failed" isn't one
     if (source === "http")
         return (/"\s(?:401|403)\s/.test(line) || /"(?:status|httpStatus|status_code|statusCode|response_status)"\s*:\s*"?(?:401|403)\b/.test(line)) && AUTH_PATH.test(line);
     return AUTH_FAIL_TEXT.test(line);

package/dist/monitor-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"monitor-rules.js","sourceRoot":"","sources":["../src/monitor-rules.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,6FAA6F;AAC7F,gGAAgG;AAChG,OAAO,EAAE,gBAAgB,EAAqB,MAAM,mBAAmB,CAAC;AAaxE,8FAA8F;AAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA,sBAAsB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iJAAiJ,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAE3M,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;QACrH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACnF,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAChG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8FAA8F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtH,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAC9F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8NAA8N,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtP,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACtG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAClH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,6JAA6J,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACrL,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACxF,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,wHAAwH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAChJ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACpG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjF,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACnG,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,+QAA+Q,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACjT,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC7F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,qHAAqH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC7I,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC5G,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvF,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACpI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,yLAAyL,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjN,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACvG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,qIAAqI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;CAC9J,CAAC;AAEF,MAAM,WAAW,GAAkB,gBAAgB,CAAC,CAAC,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;KACpK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7J,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AAEzE,MAAM,SAAS,GAAG,8JAA8J,CAAC;AACjL,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACzI,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAqB,UAAU,CAAC,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAA2B,EAAE;IACpE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SAC1B,OAAO,CAAC,+EAA+E,EAAE,wBAAwB,CAAC;SAClH,OAAO,CAAC,yLAAyL,EAAE,kBAAkB,CAAC;SACtN,OAAO,CAAC,oCAAoC,EAAE,cAAc,CAAC;SAC7D,OAAO,CAAC,uIAAuI,EAAE,cAAc,CAAC;SAChK,OAAO,CAAC,mCAAmC,EAAE,eAAe,CAAC;SAC7D,OAAO,CAAC,6CAA6C,EAAE,SAAS,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC;YAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,wGAAwG;AACxG,MAAM,cAAc,GAAG,8KAA8K,CAAC;AACtM,MAAM,UAAU,GAAG,+DAA+D,CAAC;AACnF,oHAAoH;AACpH,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,SAAS,GAAG,4FAA4F,CAAC;AAC/G,MAAM,cAAc,GAAG,qNAAqN,CAAC;AAC7O,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAkB;IAC5D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3L,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"monitor-rules.js","sourceRoot":"","sources":["../src/monitor-rules.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,6FAA6F;AAC7F,iGAAiG;AACjG,mEAAmE;AACnE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,mBAAmB,CAAC;AAGxE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAYjE,8FAA8F;AAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA,sBAAsB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iJAAiJ,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3M,8FAA8F;AAC9F,kGAAkG;AAClG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,SAAS,GAAG,0GAA0G,CAAC;AAC7H,MAAM,WAAW,GAAG,6CAA6C,CAAC;AAClE,MAAM,aAAa,GAAG,iPAAiP,CAAC;AACxQ,SAAS,IAAI,CAAC,CAAS;IACrB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,IAAI,EAAE,IAAI,GAAG,GAAG;YAAE,MAAM;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,mGAAmG;AACnG,2EAA2E;AAC3E,8EAA8E;AAC9E,MAAM,GAAG,GAAG,2VAA2V,CAAC;AACxW,MAAM,MAAM,GAAG,qDAAqD,CAAC;AACrE,wFAAwF;AACxF,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,4CAA4C,EAAE,EAAE,CAAC,CAAC;IAC7E,mFAAmF;IACnF,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,6FAA6F;IAC7F,OAAO,CAAC,SAAS,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AACD,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,GAAG,GAAG,qHAAqH,CAAC;AAClI,MAAM,UAAU,GAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrE,MAAM,cAAc,GAAG,yLAAyL,CAAC;AACjN,MAAM,aAAa,GAAG,sHAAsH,CAAC;AAC7I,yDAAyD;AACzD,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;QACrH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACnF,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAChG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8FAA8F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtH,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAC9F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8NAA8N,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtP,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACtG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAClH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,6JAA6J,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACrL,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACxF,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,wHAAwH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAChJ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACpG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjF,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,qCAAqC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACtH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvB,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACnG,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;IACtC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC7F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC3B,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC5G,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvF,6FAA6F;IAC7F,4FAA4F;IAC5F,qDAAqD;IACrD,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACpI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QAC1I,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE;IAC/D,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACvG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,qIAAqI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;CAC9J,CAAC;AAEF,2FAA2F;AAC3F,4FAA4F;AAC5F,0EAA0E;AAC1E,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU;QACrH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU;QAChI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU;QACxI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtC,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAClJ,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC5C,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;QACjI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;IAC7C,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5I,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;IAC9E,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;QACxH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;IACzC,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;QACvJ,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IAC1C,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;QACnI,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE;IACvD,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACtI,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;IACnD,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACpH,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;IACrE,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,uCAAuC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACjI,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;CACtC,CAAC;AAEF,MAAM,WAAW,GAAkB,gBAAgB,CAAC,CAAC,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;KAC3I,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzI,wFAAwF;IACxF,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AACtF,MAAM,OAAO,GAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAG,8JAA8J,CAAC;AACjL,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACzI,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAqB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAuB,EAAE;IACtG,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAA2B,EAAE;IACpE,yGAAyG;IACzG,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SACxC,OAAO,CAAC,+EAA+E,EAAE,wBAAwB,CAAC;SAClH,OAAO,CAAC,wTAAwT,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7W,OAAO,CAAC,oCAAoC,EAAE,cAAc,CAAC;SAC7D,OAAO,CAAC,uIAAuI,EAAE,cAAc,CAAC;SAChK,OAAO,CAAC,mCAAmC,EAAE,eAAe,CAAC;SAC7D,OAAO,CAAC,6CAA6C,EAAE,SAAS,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC;YAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,wGAAwG;AACxG,MAAM,cAAc,GAAG,8KAA8K,CAAC;AACtM,MAAM,UAAU,GAAG,+DAA+D,CAAC;AACnF,oHAAoH;AACpH,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,SAAS,GAAG,4FAA4F,CAAC;AAC/G,MAAM,cAAc,GAAG,qNAAqN,CAAC;AAC7O,MAAM,YAAY,GAAG,+BAA+B,CAAC;AACrD,MAAM,WAAW,GAAG,0DAA0D,CAAC;AAC/E,MAAM,SAAS,GAAG,4DAA4D,CAAC;AAC/E,MAAM,QAAQ,GAAG,uJAAuJ,CAAC;AACzK,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAkB;IAC5D,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,iDAAiD;IAC/G,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3L,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/monitor.d.ts

@@ -33,8 +33,40 @@ export interface MonitorOptions {
     fromStart?: boolean;
     /** Keep waiting while App monitoring is off in the dashboard (default) instead of exiting. */
     wait?: boolean;
+    /** LLM provider for the second opinion (--llm), with this server's own key; "beam" for Beam's model. */
+    llm?: string;
+    /** The most of one CPU core detection may use, in percent (--max-cpu). Default: monitor.json, else 25. */
+    maxCpu?: number;
+    /** A project config file to use instead of ./beam.monitor.json (--config). */
+    config?: string;
 }
 export declare function runMonitor(options: MonitorOptions, log?: (message: string) => void): Promise<void>;
-export declare function monitorStatus(write?: (line: string) => void): Promise<number>;
-/** `beam monitor test`: one test finding through the real path, to prove an integration end to end. */
-export declare function monitorTest(write?: (line: string) => void): Promise<number>;
+export declare function monitorStatus(write?: (line: string) => void, llm?: string): Promise<number>;
+/**
+ * `beam monitor test`: one test finding through the real path, to prove an integration end to end.
+ * With an own LLM (--llm), also one LLM check on a harmless sample, to prove the key works.
+ */
+export declare function monitorTest(write?: (line: string) => void, llm?: string): Promise<number>;
+export interface ConfigureOptions {
+    llm?: string;
+    model?: string;
+    baseUrl?: string;
+    keyEnv?: string;
+    key?: string;
+    forgetKey?: boolean;
+    files?: string[];
+    noFiles?: boolean;
+    app?: string;
+    noApp?: boolean;
+    maxCpu?: number;
+    /** Validate every config layer and exit 1 on a problem (for CI). */
+    check?: boolean;
+}
+/**
+ * `beam monitor configure`: saves settings to the user's monitor.json so `beam monitor` needs no
+ * flags. With no options, prints the effective settings and which layer each came from (managed,
+ * user, project, default); with --check, validates every layer for CI. A key is only ever stored
+ * from stdin (`key`), and a provider's key that isn't set in this shell is a warning, not an
+ * error: it may be set only where beam monitor runs (a systemd EnvironmentFile, a container's secrets).
+ */
+export declare function monitorConfigure(options: ConfigureOptions, write?: (line: string) => void): Promise<number>;